MEDIUM

CVE-2020-26417

Gitlab GitLab 2020-12-11 CVSS v3.1

CVSS

5.3

Description

Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.

Summary dbcve.org

GitLab CE/EE versions 13.1 through 13.6.1 contain a GraphQL API vulnerability that allows unauthorized users to query and discover private group and project membership information that should be restricted to authenticated, authorized members.

Mitigation

Upgrade GitLab to version 13.6.2, 13.5.5, or 13.4.7 or later to patch the GraphQL authorization flaw that exposes private membership data.

Weakness (CWE)

CWE-200 Information Exposure

EPSS Score

1.17%

Probability of exploitation in next 30 days

66th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26417.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/282539 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE